Zequent Client SDK — Configuration

This page describes the public configuration model for external developers and customer deployments.

Zequent platform services are run from published container images. Customer applications use the Client SDKs and connect to the service endpoints exposed by the deployment.

Container Configuration

The public customer Compose template is docker-compose.customer.yml. It references one deployment-local .env file — start from .env.customer.example (cp .env.customer.example .env, then fill in every <PLACEHOLDER>; a runnable copy of the compose file, and an actual .env.customer rather than the .example template, also lives at the same paths under core/ for working directly in the monorepo).

services:
  connector-service:
    image: ghcr.io/zequent/connector-service:2.0.0
    env_file:
      - .env

Use the same env_file: .env pattern for Zequent service images, Admin Console images, adapter images, and customer application containers.

Do not commit .env files. Store credentials and deployment-specific values in your deployment environment or secret manager.

Start the public template with:

docker compose -f docker-compose.customer.yml up -d

Optional adapter images are enabled through Compose profiles, for example:

docker compose -f docker-compose.customer.yml --profile edge-dji up -d

Platform Service Images

Use versioned image tags for production deployments (as above — not :latest). The Admin Console UI's tags carry a v prefix (v2.0.0), unlike the core service images (2.0.0).

Adapter Images

Required .env Variables (Platform Deployment)

These go in the deployment-local .env file used by docker-compose.customer.yml — not in your customer application's own .env.

Database and cache

Licensing

Every platform service verifies a license lease before performing protected operations — see Licensing.

These are configured once per installation. Organizations are licensed afterwards, from the Admin Console, with no restart — see Licensing.

LICENSING_PUBLIC_KEY and LICENSING_SIGNING_KEY_ID are not needed: the services trust only the Zequent license hub's key compiled into them, and ignore these 1.3 variables (with a warning).

Authentication

Every bearer token this deployment issues is signed with an Ed25519 keypair you generate yourself — never reuse a value from any example or dev environment:

openssl genpkey -algorithm ed25519 -out auth-private.pem
openssl pkey -in auth-private.pem -pubout -out auth-public.pem
# base64 the PKCS8/SubjectPublicKeyInfo DER (or PEM, stripped of headers/newlines)
# into the two variables below

Service identity

Every call between the platform services carries a short-lived service token. It is signed with a second Ed25519 key pair, separate from AUTH_*, one per installation. A 2.0 service refuses to start without it, and refuses a key committed to Zequent's repositories.

Live video

Client SDK Service Endpoints

Customer applications need the platform service hostnames and ports.

When the customer application runs inside the same Compose or Kubernetes network, use the service names:

When the customer application runs on the host and connects to exposed local ports, use localhost for the host values.

Client credential (ZQNT_CLIENT_TOKEN)

The platform refuses every gRPC call that carries no credential. An organization administrator issues a client credential in the Admin Console under Manage → Access & Integrations → Credentials (kind Client application); the token is shown once. Every client SDK sends it as authorization: Bearer <token>:

A client credential belongs to exactly one organization and reaches only that organization's assets, Applications and runs: asset lookups and payloads, the Skill list, Applications and executions, telemetry/detection/notification subscriptions (a * subscription carries only the organization's assets) and asset commands. Users, organizations, identity providers, licenses, triggers, schedules, policies, technical configuration and asset registration are never reachable with it. UNAUTHENTICATED means no, an expired or a revoked credential; PERMISSION_DENIED means the call is outside that scope. Revoking it in the console takes effect on every service within seconds.

Admin Console

The Admin Console has two images:

The Admin Console UI needs public API and WebSocket URLs that are reachable from the user's browser.

For a local Compose deployment, these URLs normally point to localhost:8005.

Edge Adapter Configuration

Ready-made adapter images and custom Edge SDK adapters need a reachable adapter endpoint plus any device-specific credentials.

The exact device-specific values depend on the selected adapter image.

Deployment Notes

• Keep one .env per deployment environment.
• Do not publish .env files in public documentation or source repositories.
• Keep secrets in your orchestrator's secret mechanism for production.
• Use service names for container-to-container communication.
• Use public hostnames or exposed local ports for browser-facing URLs.
• Use the Client SDK for customer applications.
• Use the Edge SDK when you need to build a custom adapter.